The Agent Skills Directory

[COMMAND_EXECUTION]: The initialization and bundling scripts (init-artifact.sh, bundle-artifact.sh) perform extensive shell operations, including system configuration, file management using cat, and stream manipulation using sed.
[EXTERNAL_DOWNLOADS]: The skill downloads and installs a large number of third-party dependencies from the npm registry during project setup, including the global installation of pnpm via npm install -g.
[COMMAND_EXECUTION]: The setup script employs node -e to programmatically parse and rewrite configuration files such as tsconfig.json and tsconfig.app.json.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the user-provided project name parameter.
Ingestion points: The init-artifact.sh script accepts a project name as a command-line argument which is used across multiple shell commands.
Boundary markers: No delimiters or isolation instructions are present to distinguish the project name from intended script commands.
Capability inventory: The script uses this input when calling system tools like pnpm, npm, and tar.
Sanitization: While the project name variable is quoted in shell scripts, it lacks comprehensive validation to prevent exploitation of parameters in the underlying tools.

artifacts-builder